SR
EN
DE
SLSecurity
How to protect a contact form from spam
Honeypot fields, rate limiting and validation — simple techniques keeping spam away without annoying CAPTCHA challenges for users.
A contact form on a public site without any protection sooner or later — usually faster than you'd expect — starts receiving automated spam: bots constantly scan the internet looking for unprotected forms and flood your inbox with meaningless or fraudulent messages, seriously making it harder to notice the real inquiries of real customers.
Effective techniques that don't require an annoying CAPTCHA
A honeypot field — an extra form field visually hidden from human visitors (via CSS), but automated bots, which don't "see" the page like a human but read the raw code, fill it in anyway — thereby giving themselves away as bots, so their message is silently discarded without any warning to the user.
Rate limiting — limits how many times the form can be submitted from the same email address or IP address in a short time period, preventing bots from flooding the inbox with hundreds of messages a minute.
Server-side validation, not only in the browser — checking the email format, the maximum length of each field's input, and similar rules must be done on the server, because browser validation is easily bypassed by sending requests directly, past the form itself.
Why we consciously avoid CAPTCHA wherever possible
CAPTCHA (that "I'm not a robot" test with pictures of traffic lights and bicycles) measurably reduces the number of real, legitimate inquiries because it frustrates and slows down real users, especially on mobile where precisely tapping small images is harder.
The combination of a honeypot field and rate limiting is most often completely sufficient spam protection, without this price in lost real inquiries and a worse experience for the people you actually want contacting you.
Nikola Cerić
Founder & CEO, Manage IT
More than 10 years of software development experience — in his own company and in major IT companies across the Balkans.